- within Compliance topic(s)
The Federal Trade Commission (FTC) hosted its Age Verification Workshop Jan. 28 and was focused on the intersection of age verification technologies and Children's Online Privacy Protection Act (COPPA) compliance, reflecting the FTC's growing scrutiny of youth privacy and child safety issues. When the FTC announced this workshop, its press release made clear that the workshop would cover topics such as why age verification matters, age verification and estimation tools, how to navigate the regulatory contours of age verification, how to deploy age verification more widely, and the interplay between age verification technologies and the COPPA Rule. Workshops are building blocks at the FTC, often leading to information gathering and FTC reports or guidance, which can lead to additional rules, enforcement actions, and perhaps recommendations to Congress.
The workshop kicked off with remarks from Chairman Andrew Ferguson, who explained that the purpose of this workshop was to determine best practices and possible pitfalls for the use of age verification technologies as they relate to COPPA. Protecting children online and COPPA remain top priorities of this FTC, as it continues to settle public enforcements with a variety of companies, including those with branding that is familiar to children. COPPA requires "verifiable parental consent" before collecting, using, or disclosing personal information from children under the age of 13. Verifiable parental consent is not the same as age verification of the child; however, the two work hand in hand.
What Are Age Verification Technologies?
The workshop focused on four types of age verification technologies: declaration, inference, estimation, and verification. Each of these technologies has its own limitations and strengths.
Declaration, such as an age gate, where a child inputs their birthdate, was discussed during the workshop as the least reliable method, as children can easily bypass it.
Inference draws reasonable conclusions based on certain indicators, such as a long-established email address or financial transactions. For example, a user's submission of an email address and job title indicates that they are likely over 13.
Estimation-based age verification can use facial analysis or other trait-based signals to estimate a person's age range. For example, rather than inferring whether a person is over or under 13, age estimation technology attempts to determine approximately what age a person may be.
And finally, the FTC discussed a more accurate form of verification, such as requiring a user to upload a copy of their government-issued ID, which would provide their age, and then matching the picture on the ID against a selfie to confirm that the user is the same person as on the ID.
The workshop highlighted certain industry trends moving toward a reusable age token to avoid repeated friction. If a person can verify their age once and then deploy the age token multiple times across a multitude of online services, it could be a better experience for both the user and the online services. Some businesses are considering a "waterfall approach," where users will start with less invasive age verification technologies for services that pose lower risks and then be required to engage with more invasive technologies for services with escalated risks. There was also discussion about a double-blind model, where the verification provider (not necessarily the online service) does not know the user's intended online destination and the online service is not aware of the user's identity. A double-blind model preserves certain anonymity online while also preventing younger users from engaging with content that may not be appropriate for them.
Why Should Online Services Care About Age Verification?
As Ferguson indicated, "the fruits of this workshop" would be used to inform future FTC policy decisions on age verification technologies and to possibly amend COPPA to promote such technologies. Further, FTC Commissioner Mark Meador noted that age verification not only offers an opportunity to "unleash American innovation without compromising the health and well-being" of children but also can be an empowering tool for parents.
Remarks such as these signal a shift in regulatory posture that is keen on being actively engaged with industry and its implementation of innovative age verification technologies. This stance also reflects a growing confidence in the feasibility and availability of age verification technologies. One panelist noted that the technological means currently exist, such as age keys, a tool that cryptographically transmits information and is usable only by the key's specific user, that could work hand in hand with regulators' expectations. But as many panelists in the workshop noted, age verification technologies are not a one-size-fits-all solution. Especially where they can contribute to an online service's knowledge about the general age of its users and whether it would be reasonably accessible by minors under 18, implementing age verification technologies could inadvertently trigger compliance obligations outside COPPA, such as state comprehensive privacy laws and age-appropriate design codes. Industry leaders should consider the tool best suited to their platform and services while also balancing regulatory scrutiny and involvement as age verification technologies gain in widespread use and popularity.
The FTC's workshop underscored a change in its regulatory approach: Age assurance is no longer an academic exercise and will now be a compliance expectation for online service providers. This is an opportunity for advertisers to reevaluate how they collect data and process it, particularly where age indicators are weak or unverified, and how that may affect the defensibility of age-appropriate segmentation. Platforms and online services have a chance to map out where higher-assurance checks may be necessary, particularly where user-generated or child-directed content is involved. Age verification providers and emerging tech vendors should also be wary of regulators' increased demands for privacy-preserving architecture, such as double-blind models.
Of note, the workshop also highlighted conversations and panelists in relation to the UK Age Appropriate Design Code and its age verification and age assurance requirements. This law has been fully enforceable since 2021 and served as a model for age-appropriate design codes in the U.S. Input from U.K.-based panelists on the U.S. approach indicates international cooperation around age verification technologies.
The message from the workshop was clear: All entities across industry (vendor, advertiser, and online service provider) are encouraged to innovate toward compliance, not around it.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
